Drupal Camtasia Relay Module Cross-Site Scripting Vulnerability

Drupal is an open source content management framework written in the PHP language. A cross-site scripting vulnerability exists in the Drupal Camtasia Relay Module, which can be exploited by an attacker to execute arbitrary script code in a browser to steal cookie-based authentication credentials...

Drupal MailChimp module cross-site scripting vulnerability (CNVD-2015-05690)

Drupal is the Drupal community maintained by a set of free, open source content management system developed in PHP. MailChimp is one of the third-party mail delivery service provider MailChimp integration module. A cross-site scripting vulnerability exists in the MailChimp Signup submodule of the...

Drupal Smart Trim module cross-site scripting vulnerability (CNVD-2015-05695)

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community.Smart Trim is one of the text field formatting modules. A cross-site scripting vulnerability exists in the Drupal Smart Trim module in versions 7.x-1.5 prior to 7.x-1.x. A remote attack...

Drupal Workbench Email Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Workbench Email is one of the modules used to define and configure email conversions. A security bypass vulnerability exists in versions 7.x-3.x prior to 7.x-3.4 of the Drupal Workbench...

Drupal Search API Autocomplete Module Cross-Site Scripting Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Search API Autocomplete is one of the modules used to add autocomplete functionality to search fields during searches and provide a list of suggestions. A cross-site scripting...

Drupal Entityform Block Module Security Bypass Vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Entityform Block is one of the modules that outputs the specified Entityform which provides a solution for website surveys, contact forms as a block. A security vulnerability exists ...

Drupal Shipwire API Module Security Bypass Vulnerability

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community. the Shipwire API is one of the modules responsible for communicating with the Shipwire Shipping Service. A security vulnerability in the Drupal Shipwire API module 7.x-1.03 prior to...

Drupal Navigate module cross-site scripting vulnerability (CNVD-2015-05492)

Drupal is a free, open source content management system developed in PHP and maintained by the Drupal community.Navigate is one of the customizable navigation modules that supports rapid deployment. A cross-site scripting vulnerability exists in the Drupal Navigate module. A remote attacker can...

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-003

This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTML element. This vulnerability is...

Drupal Releases Security Updates

Drupal has released updates to address multiple vulnerabilities, one of which could allow an attacker with elevated permissions to inject malicious code. Available updates include: Drupal core 6.37 for 6.x users Drupal core 7.39 for 7.x users US-CERT encourages users and administrators to review...

Search API Autocomplete - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-140

This module enables you to add autocomplete suggestions for search forms created with the Search API module. The module doesn't sufficiently sanitize the HTML output for the returned suggestions, theoretically allowing an attacker to include custom HTML there. This vulnerability is mitigated by t...

drupal -- multiple vulnerabilities

Drupal development team reports: This security advisory fixes multiple vulnerabilities. See below for a list. Cross-site Scripting - Ajax system - Drupal 7 A vulnerability was found that allows a malicious user to perform a cross-site scripting attack by invoking Drupal.ajax on a whitelisted HTML...

Drupal Webform Matrix Component Module Cross-Site Scripting Vulnerability

Drupal is the Drupal community maintains a set of free , open-source content management system developed in PHP language . Webform Matrix Component is one of the matrix/tabular input component module provides . A cross-site scripting vulnerability exists in the Drupal Webform Matrix Component...

Drupal Dynamic display block module security bypass vulnerability

Drupal is a free and open source content management system developed in PHP and maintained by the Drupal community.Dynamic display block is one of the featured content slideshow modules. A security vulnerability exists in the Drupal Dynamic display block module in versions 7.x-1.1 and earlier. A...

Drupal Mobile sliding menu module cross-site scripting vulnerability

Drupal is the Drupal community maintained by a set of free , open source content management system developed in PHP. mobile sliding menu is one of the integrated menu jQuery plugin module . A cross-site scripting vulnerability exists in the Drupal Mobile sliding menu module in versions 7.x-2.1 an...

Ctools - Critical - Multiple Vulnerabilities - SA-CONTRIB-2015-141

Cross Site Scripting XSS Ctools in Drupal 6 provides a number of APIs and extensions for Drupal, and is a dependency for many of the most popular modules, including Views, Panels and Entityreference. Many features introduced in Drupal Core once lived in ctools. This vulnerability can be mitigated...

Drupal Video Consultation Module Cross-Site Scripting Vulnerability

Drupal is a free, open-source content management system developed in PHP and maintained by the Drupal community. video Consultation is one of the video communication software modules. A cross-site scripting vulnerability exists in the Drupal Video Consultation module. A remote attacker can use th...

Workbench Email - Moderately Critical - Access bypass - DRUPAL-SA-CONTRIB-2015-139

Workbench Email module provides a way for administrators to define email transitions and configurable email subject / messages between those transitions. The module causes node and field validations to be skipped when saving nodes. The vulnerability is mitigated by the fact that an attacker must...

CVE-2015-5515

The Views Bulk Operations VBO module 6.x-1.x and 7.x-3.x before 7.x-3.3 for Drupal, when the bulk operation for changing Roles is enabled, allows remote authenticated users to edit user accounts and add arbitrary roles to the accounts by leveraging access to a user account listing view with VBO...

CVE-2015-5514

Cross-site scripting XSS vulnerability in the Migrate module 7.x-2.x before 7.x-2.8 for Drupal, when the migrateui submodule is enabled, allows user-assisted remote attackers to inject arbitrary web script or HTML via a destination field label...